FINN Real Estate Properties and Details Scraper

This Actor was designed to extract public property cards from FINN.no real-estate search pages and enrich selected listings with public detail-page fields.

Automated requests are disabled by default. FINN's user terms, section 6, require prior written permission for copying and prohibit automated services or systematic/regular copying without explicit written consent. Section 7 requires a separate business agreement for commercial use. Set authorizationConfirmed to true only when your written authorization covers the planned automated access and content use. With the default false value, the Actor makes zero source requests and reports SUCCEEDED/SKIPPED_POLICY in its OUTPUT summary without adding a diagnostic to the dataset.

When authorized access is confirmed, the Actor accepts only HTTPS FINN real-estate URLs on finn.no or www.finn.no. It makes direct requests only, refuses redirects, and stops on access blocks or security challenges without using an alternate transport. Only validated property listings are written to the dataset; failures are kept in OUTPUT. A failed run with no saved property listings reports FAILED/FAILED and exits nonzero. If valid property listings were saved before a later failure, it reports SUCCEEDED/PARTIAL and exits successfully.

Inputs are urls, authorizationConfirmed, maxListings, includeDetails, and timeoutSecs. Existing storage remains historical and should not be treated as a fresh source verification.

The local dataset contains one historical record from August 31, 2026. The current schema declares 36 possible top-level fields; the saved row has 19 nonempty fields and passes the local schema and summary checks. It falls in the medium (15–27 fields) band used by the local dataset review. It does not demonstrate current extraction. No fields were guessed or added because current FINN terms require prior written consent for copying and automated or systematic collection, and commercial use requires a Partner Agreement.

Dependency security

The locked dependency graph overrides basic-ftp with the patched 6.2.1 release. The SDK’s unpatched HTTP cache policy is replaced with the readable local vendor/noncaching-http-policy adapter, which refuses cache reads and writes and forces fresh network responses. This is an explicit removal of caching, not a claimed upstream security patch. Source transports, permission gates and request limits are unchanged. npm run test:dependencies checks cross-user cache isolation, imported stale policy rejection, FTP integration methods and adversarial listing parsing. Cloud builds run npm audit --omit=dev --audit-level=low against the installed production graph.